Security model
Flarebox holds a credential that can change a live domain. Its design started with a written security review, before any code, listing each threat, the decision made about it, and the test that enforces it. This page summarizes it.
Threats and decisions
Section titled “Threats and decisions”| Threat | Decision |
|---|---|
| The token is stolen from disk | Only in Windows Credential Manager, encrypted with DPAPI under your login. Never in a settings file, the local database, history, snapshots, logs or crash output |
| The token reaches the web view (an XSS bug could read it) | It crosses in once, when you paste it, into a field cleared right after. No command ever returns it. The window gets a status only. A strict CSP means even injected script can’t send data to the network |
| One stolen token changes production | Two slots. The read token can’t change anything. The write token is loaded only inside a change you’ve approved |
| The window applies a change you didn’t review | Plans are built and held in the Rust core. Applying takes a plan id, not a payload. One use, within 10 minutes |
| A stale review overwrites someone else’s change | The target is read again just before writing. If it changed since you looked, the change is refused |
| The token goes to the wrong server | The base URL is fixed to api.cloudflare.com, and redirects are never followed, so the Authorization header can’t be carried elsewhere |
| The token leaks through logs or errors | The token type prints as Token(…redacted…) and is zeroed when dropped. Error messages are built from Cloudflare’s codes and the path, never from headers |
| A retry writes twice | Only reads retry on errors. Writes retry only on HTTP 429, where Cloudflare didn’t process the request. A write that times out is reported as unknown, then re-read |
| The rate limit locks you out | Requests are sequential. Flarebox stops itself at 1,000 per 5 minutes (Cloudflare’s limit is 1,200, shared with the dashboard), and waits when fewer than 20 remain |
| Origin checks probe hosts they shouldn’t | Only the origins in your own proxied records, only on a click, at most 20 a run, never private or placeholder addresses |
| An irreversible action looks reversible | Every plan says whether it can be undone. Irreversible ones need the name typed |
| The local store is tampered with | It only holds the last state seen. Writes always re-read live state first, so a tampered store can’t change what’s written |
Post-quantum by default
Section titled “Post-quantum by default”Flarebox’s own API client uses rustls with the aws-lc-rs provider and prefers X25519MLKEM768. A unit test checks the group order, and against the real API, Cloudflare’s trace endpoint reported kex=X25519MLKEM768.
Secrets that aren’t API tokens
Section titled “Secrets that aren’t API tokens”| Secret | How it’s handled |
|---|---|
| Worker secrets | To wrangler secret put on standard input. Never stored, logged or shown |
.dev.vars values |
Masked until shown. Never logged, stored or put in an error |
| Tunnel run tokens | Fetched per run, passed to cloudflared in an environment variable, scrubbed from its output, never stored |
| Origin CA and ML-DSA private keys | Made on your machine and written as new files only. Never sent, never in history |
| Logpush destination credentials | Sent to Cloudflare only. Stored as *** in history and never shown in lists |
What Flarebox sends, and where
Section titled “What Flarebox sends, and where”api.cloudflare.com, for the Cloudflare views.- Your own servers, only on a click: pqdoctor probes of your origins, and the cache check’s one GET to a URL on your zone.
- cloudflared, when you run a tunnel.
- The registrar expiry check, the one background call (to
api.cloudflare.com, with the read token). - wrangler, for Workers features, which talks to Cloudflare with your
wrangler login.
No telemetry. No analytics. Flarebox doesn’t phone home.
Residual risks
Section titled “Residual risks”- Malware running as your Windows user can read Credential Manager. No desktop app can prevent that. wrangler’s own login file is plain text, so this is no weaker than what you already have.
- The installers aren’t code-signed yet. Check the SHA-256 of what you download.
Reporting a vulnerability
Section titled “Reporting a vulnerability”Email hi@kalyangopalam.com with “security” in the subject. Please don’t open a public issue for a vulnerability.